2026-05-29_113f41165d5cea55ace02427f6ab3bb9_amadey_elex_glassworm_manuscrypt_rhadamanthys_stop_vidar

General

Target
2026-05-29_113f41165d5cea55ace02427f6ab3bb9_amadey_elex_glassworm_manuscrypt_rhadamanthys_stop_vidar
Size 4.1MB
Sample260529-ndkr3sat3v
SHA256 92cbfb1cc4b2c162b94d67ca23e254db18f977168c218533305352b42ebf016d
MD5 113f41165d5cea55ace02427f6ab3bb9
SHA1 c101228769c3690feb7a2cf24d550001cb6f74b5
SHA512 385d15f020a855ab14572909dcfdb40c78050073b6ac37754dbf7109a9756a151c798a601bbb5b75b381367892dd66d3317bf17170cb084eaa875a48b0ffbeb1
SSDEEP 49152:dqCHZqhaK6zbfqdl1DkYOMwwnMb4PmyV9cY/Pss1T1Pji0Ajny6i1zuajsauZnJG:d1Hx3YOXwnS4rVKCDjort2
TLSH
T1F6166C15B3A44171D462C23585A1EA5EE632BC1167328ECF2281BEAEFFB37D14936731
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-29_113f41165d5cea55ace02427f6ab3bb9_amadey_elex_glassworm_manuscrypt_rhadamanthys_stop_vidar

File Explorer

2026-05-29_113f41165d5cea55ace02427f6ab3bb9_amadey_elex_glassworm_manuscrypt_rhadamanthys_stop_vidar

.exe 4.1MB

2026-05-29_113f41165d5cea55ace02427f6ab3bb9_amadey_elex_glassworm_manuscrypt_rhadamanthys_stop_vidar

IMPHASH 440bc139f19edeac18ebed46859ccfed
SHA256 92cbfb1cc4b2c162b94d67ca23e254db18f977168c218533305352b42ebf016d
MD5 113f41165d5cea55ace02427f6ab3bb9
SHA1 c101228769c3690feb7a2cf24d550001cb6f74b5
SHA512 385d15f020a855ab14572909dcfdb40c78050073b6ac37754dbf7109a9756a151c798a601bbb5b75b381367892dd66d3317bf17170cb084eaa875a48b0ffbeb1
SSDEEP 49152:dqCHZqhaK6zbfqdl1DkYOMwwnMb4PmyV9cY/Pss1T1Pji0Ajny6i1zuajsauZnJG:d1Hx3YOXwnS4rVKCDjort2
TLSH
T1F6166C15B3A44171D462C23585A1EA5EE632BC1167328ECF2281BEAEFFB37D14936731
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

42217

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

g:\Acro_root_atg\Plugins\Updater\acroaum\win\Release\acroaum.pdb

kernel32

LoadLibraryW GetProcAddress MultiByteToWideChar WideCharToMultiByte TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RaiseException RtlUnwind GetCommandLineA HeapFree GetVersionExA HeapAlloc GetProcessHeap GetStartupInfoA GetLastError GetModuleHandleA TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement Sleep HeapSize ExitProcess WriteFile GetStdHandle GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType DeleteCriticalSection HeapDestroy HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LeaveCriticalSection EnterCriticalSection VirtualAlloc HeapReAlloc GetCPInfo GetACP GetOEMCP LoadLibraryA InitializeCriticalSection GetLocaleInfoA GetStringTypeA GetStringTypeW LCMapStringA LCMapStringW ReadFile SetFilePointer SetStdHandle GetConsoleCP GetConsoleMode FlushFileBuffers CloseHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA

user32

MessageBoxA

advapi32

RegQueryValueExW RegOpenKeyExA RegQueryValueExA RegOpenKeyExW

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-29_113f41165d5cea55ace02427f6ab3bb9_amadey_elex_glassworm_manuscrypt_rhadamanthys_stop_vidar

kernel32

user32

advapi32

generic